Unauthorized Log Disclosure in WWBN AVideo CloneSite Plugin

Executive Summary

This vulnerability exists in WWBN AVideo versions 26.0 and prior, specifically in the CloneSite plugin. The endpoint plugin/CloneSite/client.log.php serves the clone operation log file without requiring any authentication, unlike other endpoints in the same plugin directory which require admin privileges. This log file contains sensitive information such as internal filesystem paths, remote server URLs, and SSH connection metadata.

Useful 0 Not Useful 0

Impact Analysis

Because the clone operation log file is accessible without authentication, an attacker can obtain sensitive internal information about the system. This includes filesystem paths, remote server URLs, and SSH connection details, which could be used to facilitate further attacks, reconnaissance, or unauthorized access.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows unauthenticated access to a log file containing internal filesystem paths, remote server URLs, and SSH connection metadata. This exposure of potentially sensitive internal information could lead to non-compliance with data protection standards such as GDPR and HIPAA, which require safeguarding sensitive data and controlling access to it.

However, the provided information does not explicitly state the impact on compliance with these standards.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking if the plugin/CloneSite/client.log.php endpoint is accessible without authentication on your WWBN AVideo installation. Since this endpoint serves the clone operation log file without requiring admin privileges, you can attempt to access it directly via HTTP requests.

• Use curl or wget to request the URL: curl -I http://your-avideo-domain/plugin/CloneSite/client.log.php
• Check if the response status is 200 OK and if the content contains internal filesystem paths, remote server URLs, or SSH connection metadata.
• Scan web server logs or use web vulnerability scanners to identify unauthenticated access to this endpoint.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability immediately, restrict access to the plugin/CloneSite/client.log.php endpoint to authorized users only.

• Apply authentication checks similar to other endpoints in the CloneSite plugin directory, enforcing User::isAdmin() or equivalent.
• If possible, restrict access to this endpoint via web server configuration (e.g., IP whitelisting or authentication).
• Update WWBN AVideo to a version later than 26.0 where this issue is fixed.
• Avoid exposing sensitive log files publicly to prevent leakage of internal filesystem paths and SSH metadata.

Useful 0 Not Useful 0